New ClickFix Attack leverages Windows Terminal for Payload Execution
Recent findings indicate a new series of ClickFix attacks leveraging Windows Terminal for direct payload execution on target systems. This method enhances the plausibility and eludes detection by avoiding the conventional Windows Run dialog.
Recent findings indicate a new series of ClickFix attacks leveraging Windows Terminal for direct payload execution on target systems. This method enhances the plausibility and eludes detection by avoiding the conventional Windows Run dialog.
The recent attack campaign encourages users to access a privileged command environment, diverging from previous methodologies. Initially identified in early 2024, ClickFix exploited fake browser errors to execute harmful commands. The prevalence of this attack method has surged by 517% in 2025, ranking it as a significant global threat vector.
Attackers employ tactics such as fake CAPTCHA pages and urgent alerts to prompt user response. A campaign identified in February 2026 specifically targets Windows Terminal, bypassing security measures meant to detect Run dialog misuse.
The campaign instructs users to use the Windows + X shortcut followed by "I" to open Windows Terminal, avoiding traditional security flags. This method places users into a command-line environment that mimics legitimate IT operations.
Microsoft's 2025 Digital Defense Report highlights ClickFix as a leading initial access method, surpassing phishing, with a 47% share of tracked attacks. The campaign's payload, Lumma Stealer, is designed to harvest credentials and sensitive browser data.
Recent findings indicate a new series of ClickFix attacks leveraging Windows Terminal for direct payload execution on target systems.
The attack begins when a victim accesses a compromised site, where hidden scripts copy a PowerShell command to the clipboard. Users are then prompted by a deceptive CAPTCHA to paste this command into Windows Terminal.
This initiates a PowerShell process that downloads additional malicious components, including a renamed executable and a ZIP archive, which execute without user awareness. The malware establishes persistence via a scheduled task, embedding itself into browser processes to extract credentials.
Detection is complicated by the trusted status of Windows Terminal components, making it challenging for security tools to identify malicious activity.
Organizations should enforce policies preventing command pasting from web prompts and restrict Windows Terminal and PowerShell access to administrative accounts. Regular inspections of registry keys and scheduled tasks are recommended.
Endpoint detection tools should monitor PowerShell activities initiated by Windows Terminal, and antimalware definitions should be updated consistently across all systems.
Based on reporting by Cyber Security News.